CVE-2026-15981

The CVE describes an unauthenticated authentication bypass in the WordPress SAML SSO Login plugin up to version 5.4.4. The root cause is mo_saml_validate_signature() evaluating the OpenSSL verify result (-1) as truthy due to a loose boolean check on the value returned by PHP openssl_verify(). Thi...

CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65526

The CVE-2026-65526 entry concerns the WordPress Visualizer plugin (versions up to and including 4.0.6). The vulnerability is described as a Contributor SQL Injection in Visualizer

CVE-2026-65492 WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Dokan Pro = 5.0.0 versions...

CVE-2026-65474

The CVE concerns WordPress Ninja Tables plugin

CVE-2026-65469

CVE-2026-65469 affects the WordPress plugin “AWP Classifieds” up to version 4.4.7. The vulnerability is an unauthenticated Broken Access Control issue in AWP Classifieds

CVE-2026-65455

CVE-2026-65455 affects the WordPress MapSVG plugin up to version 8.14.0. The vulnerability is described as an Administrator Arbitrary File Upload, with an overall CVSSv3.1 base score of 9.1 (CRITICAL) and a network attack vector, requiring high privileges and no user interaction. The reports do n...

CVE-2026-59526

CVE-2026-59526 : Unauthenticated SQL injection in WordPress MapSVG plugin ≤ 8.14.0. Reported as a critical vulnerability (CVSS 3.1: 9.3) with network access and no privileges required; confidentiality impact High, availability Low, no integrity impact. The connected documents confirm the issue bu...

CVE-2026-59524

The CVE concerns WordPress Easy Digital Downloads plugin ≤ 3.6.7 with Unauthenticated Broken Authentication . Affected component: the EDD plugin for WordPress; versions up to 3.6.7 are implicated. Root cause details are not specified in the provided documents. Impact is described as unauthenticat...

CVE-2026-59512

CVE-2026-59512 describes an unauthenticated XSS in WordPress plugin Product Enquiry for WooCommerce, versions

CVE-2026-57699

The CVE-2026-57699 entry concerns the WordPress Slider Pro plugin (versions ≤ 4.8.13) with a Cross Site Scripting (XSS) vulnerability affecting subscribers. The Patchstack-backed details identify the affected component and vulnerability type, with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/...

CVE-2026-57374

CVE-2026-57374 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress Funnel Kit Funnel Builder PRO plugin, versioned &lt;= 3.15.0.7. The CVSS v3.1 base score is 7.1 (HIGH) with NETWORK attack vector, LOW impacts to confidentiality/integrity/availability, and user ...

CVE-2026-27403

CVE-2026-27403 concerns the WordPress Hubbub Lite plugin, versions

WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Visualizer versions = 4.0.1...

EUVD-2026-47925

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-47927

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-14322

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment...

PT-2026-63361

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the update user task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from...

WordPress Easy Form Builder by WhiteStudio – Drag & Drop Form Builder plugin <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by ? in WordPress Plugin Easy Form Builder versions = 4.0.11...

CVE-2026-8082 Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection

The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPres...